ansible/roles/podman/tasks/main.yml

# code: language=ansible

- name: Install podman packages
  community.general.pacman:
    name:
      - nginx
      - podman
      - passt
      - podlet
      - podman-compose
      - fuse-overlayfs
    state: present
    update_cache: true

- name: Enable kernel.unprivileged_userns_clone
  ansible.posix.sysctl:
    name: kernel.unprivileged_userns_clone
    reload: true
    state: present
    sysctl_set: true
    value: 1

- name: Create an unprivileged user to run quadlet files as
  ansible.builtin.user:
    comment: Quadlet services user
    create_home: true
    home: /home/quadlet
    name: quadlet
    password: '!'
    password_lock: true
    shell: /usr/bin/bash
    state: present
    system: false # Can't be a system user or subuid/subgid entries don't get created

- name: Ensure graphroot location exists for unprivileged user
  ansible.builtin.file:
    group: quadlet
    mode: '0750'
    owner: quadlet
    path: "/home/quadlet/.local/share/containers/storage"
    state: directory

- name: Enable linger for unprivileged user
  ansible.builtin.command:
    cmd: loginctl enable-linger quadlet
    creates: /var/lib/systemd/linger/quadlet
  register: podman_enable_linger_result

- name: Reboot if enabling lingering caused a change # noqa: no-handler
  when:
    - podman_enable_linger_result is changed
  ansible.builtin.reboot:
    post_reboot_delay: 10
    test_command: whoami

- name: Create directories for quadlet volumes
  ansible.builtin.file:
    group: quadlet
    mode: '0775'
    owner: quadlet
    path: /quadlet/{{ item }}
    state: directory
  loop: "{{ podman_containers }}"

- name: Create quadlet systemd user directory
  ansible.builtin.file:
    group: root
    mode: '0775'
    owner: root
    path: /etc/containers/systemd/users/quadlet
    state: directory

- name: Create shared container image directory
  ansible.builtin.file:
    group: root
    mode: '0755'
    owner: root
    path: /var/containers/images
    state: directory

- name: Pull required container images into shared storage for all users
  containers.podman.podman_image:
    name: "{{ item }}"
    platform: linux/amd64
    pull: true
    pull_extra_args: --imagestore=/var/containers/images
    state: present
  loop:
    - "{{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}"
    - "{{ podman_distribution_registry }}/{{ podman_distribution_repository }}:{{ podman_distribution_version }}"
    - "{{ podman_git_server_registry }}/{{ podman_git_server_repository }}:{{ podman_git_server_version }}"

- name: Recurse shared image storage and make contents readable for all users
  ansible.builtin.command:
    cmd: chmod -R u=rwX,g=rX,o=rX /var/containers/images
  changed_when: true

- name: Add containers storage.conf file
  ansible.builtin.copy:
    dest: /etc/containers/storage.conf # Can NOT go in the drop in containers.conf.d directory
    group: root
    mode: '0644'
    owner: root
    src: "{{ role_path }}/files/storage.conf"

- name: Template out volume unit files
  ansible.builtin.template:
    dest: /etc/containers/systemd/users/quadlet/{{ item }}.volume
    group: root
    mode: '0644'
    owner: root
    src: "{{ role_path }}/templates/quadlet.volume.j2"
  loop: "{{ podman_containers }}"
  notify:
    - Quadlet daemon-reload

- name: Template out network unit file
  ansible.builtin.template:
    dest: /etc/containers/systemd/users/quadlet/dual-stack.network
    group: root
    mode: '0644'
    owner: root
    src: "{{ role_path }}/templates/dual-stack.network.j2"
  notify:
    - Quadlet daemon-reload

- name: Template out container unit files
  ansible.builtin.template:
    dest: /etc/containers/systemd/users/quadlet/{{ item }}.container
    group: root
    mode: '0644'
    owner: root
    src: "{{ role_path }}/templates/{{ item }}.container.j2"
  loop:
    - technitium
  notify:
    - Quadlet daemon-reload

- name: Flush handlers to trigger daemon-reload
  ansible.builtin.meta: flush_handlers

- name: Enable IP forwarding
  ansible.posix.sysctl:
    name: "{{ item }}"
    reload: true
    state: present
    sysctl_set: true
    value: 1
  loop:
    - net.ipv4.ip_forward
    - net.ipv6.conf.all.forwarding

# Enable forwarding rules in UFW

# Enable/start user service

# Add to containers.conf
# [network]
# rootless_port_forwarder="pasta"